Synthesis of Evidence on Existing and Emerging Social Engineering Ransomware Attack Vectors

Abstract

As the threat landscape continues to evolve, users are becoming less aware, ignorant, or negligent, putting their confidential data at risk. Users easily fall prey to socially engineered ransomware attacks that encrypt and lock a computer or mobile device, holding it hostage unless a ransom is paid. The cryptoware encrypts data securely, making it almost impossible for anyone except the hacker to unlock the device. This research conducts a systematic review to identify methods for executing socially engineered ransomware attacks. Using a CRI framework, 122 studies were synthesized from 3209 research articles highlighting gaps in identifying and analyzing attack vectors, as well as the need for a holistic approach to ransomware with behavioural control as part of the solution. Human vulnerability was found to be a critical point of entry for miscreants seeking to spread ransomware. This review will be useful in developing control models that will educate organisations and security professionals to focus on adopting human-centered solutions to effectively counter ransomware attacks.